CVE-2012-2403

WordPress: CVE-2012-2403 affects wp-includes/formatting.php in WordPress prior to 3.3.2, where clickable links inside HTML attributes enable cross-site scripting (XSS) via unspecified vectors. The underlying issue is improper handling of links in attributes, allowing injected scripts to execute i...

CVE-2012-2403: Improper Neutralization of Input During Web Page Generation

wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

CVE-2012-2400: Undefined Security Weakness

Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors...

CVE-2011-3128

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php...

CVE-2011-3128: Exposure of Sensitive Information to an Unauthorized Actor

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php...

CVE-2011-3130: Improper Neutralization of Special Elements used in an SQL Command

wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection...

CVE-2010-4257

CVE-2010-4257 is a SQL injection in WordPress up to version 3.0.2 affecting the do_trackbacks function in wp-includes/comment.php. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field due to improper input sanitization. Related adviso...

CVE-2010-4257: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the dotrackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field...

Wordpress function do_trackbacks() SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================================== Wordpress function dotrackbacks SQL Injection Vulnerability ============================================================== Description: SQL injection vulnerability in dotrackbacks...

WordPress MU 1.2.2 - 1.3.1 'wp-includes/wpmu-functions.php' CSS

Exploit for unknown platform in category web applications ================================================================================ WordPress MU 1.2.2 - 1.3.1 'wp-includes/wpmu-functions.php' Cross-Site Scripting Vulnerability...

CVE-2009-1030: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the chooseprimaryblog function in wp-includes/wpmu-functions.php in WordPress MU WPMU before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header...

CVE-2008-5278: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the selflink function in in the RSS Feed Generator wp-includes/feed.php for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header HTTPHOST variable...

CVE-2008-4769

Directory traversal vulnerability in the getcategorytemplate function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from thi...

CVE-2008-4769: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the getcategorytemplate function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from thi...

CVE-2008-3747: Undefined Security Weakness

The 1 geteditpostlink and 2 geteditcommentlink functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie...

CVE-2008-2146: Undefined Security Weakness

wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATHINFO $PHPSELF, which allows remote attackers to bypass intended access restrictions for certain pages...

CVE-2007-6318: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the s parameter, when DBCHARSET is set to 1 Big5, 2 GBK, or possibly other character set encodings that support a "" in a multibyte character...

CVE-2007-3639

WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via 1 the wphttpreferer parameter to wp-pass.php, related to the wpgetreferer function in wp-includes/functions.php; and possibly other vectors related to 2...

CVE-2007-1894

CVE-2007-1894 describes an XSS in WordPress via the year parameter in wp_title, in the file wp-includes/general-template.php, before 20070309. The linked Debian advisory confirms fixes in WordPress versions 2.0.10-1 and 2.1.3-1 (DSA-1285-1). Other references (NVD OSV, OSV-DEBIAN) corroborate the ...

CVE-2007-1894: Undefined Security Weakness

Cross-site scripting XSS vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wptitle function...